From 282d9d93ca7ac148a0caa59a9d610afa7428318b Mon Sep 17 00:00:00 2001 From: akash1810 Date: Mon, 6 Jul 2026 14:06:59 +0100 Subject: [PATCH] fix(GuParameterStoreReadPolicy): Remove hard-coded `PolicyName` In v64.0.0 `GuParameterStoreReadPolicy` became a singleton scoped to an `App`. This change stops hard-coding the `PolicyName` property, reverting to AWS default behaviour. This is because `AWS::IAM::Policy` resources in a CFN stack must have a unique policy name. --- .changeset/plain-colts-jam.md | 6 ++++++ .../iam/policies/parameter-store-read.test.ts | 1 - src/constructs/iam/policies/parameter-store-read.ts | 1 - .../iam/roles/__snapshots__/instance-role.test.ts.snap | 10 +++++----- .../patterns/__snapshots__/ec2-app.test.ts.snap | 2 +- .../__snapshots__/gu-load-balanced-app.test.ts.snap | 8 ++++---- src/patterns/ec2-app/__snapshots__/base.test.ts.snap | 4 ++-- 7 files changed, 18 insertions(+), 14 deletions(-) create mode 100644 .changeset/plain-colts-jam.md diff --git a/.changeset/plain-colts-jam.md b/.changeset/plain-colts-jam.md new file mode 100644 index 0000000000..6af0ba8a92 --- /dev/null +++ b/.changeset/plain-colts-jam.md @@ -0,0 +1,6 @@ +--- +"@guardian/cdk": minor +--- + +Update the `GuParameterStoreReadPolicy` construct to remove the hard-coded `PolicyName` property. +This allows the `GuParameterStoreReadPolicy` singleton to be instantiated multiple times in a single `GuStack` when there are multiple apps. diff --git a/src/constructs/iam/policies/parameter-store-read.test.ts b/src/constructs/iam/policies/parameter-store-read.test.ts index f3daad050e..d1f3f81693 100644 --- a/src/constructs/iam/policies/parameter-store-read.test.ts +++ b/src/constructs/iam/policies/parameter-store-read.test.ts @@ -13,7 +13,6 @@ describe("GuParameterStoreReadPolicy", () => { Template.fromStack(stack).resourceCountIs("AWS::IAM::Policy", 1); Template.fromStack(stack).hasResourceProperties("AWS::IAM::Policy", { - PolicyName: "parameter-store-read-policy", PolicyDocument: { Version: "2012-10-17", Statement: [ diff --git a/src/constructs/iam/policies/parameter-store-read.ts b/src/constructs/iam/policies/parameter-store-read.ts index 9c2bca0a57..85d9b5f387 100644 --- a/src/constructs/iam/policies/parameter-store-read.ts +++ b/src/constructs/iam/policies/parameter-store-read.ts @@ -47,7 +47,6 @@ export class GuParameterStoreReadPolicy extends GuAppAwareConstruct(GuPolicy) { private constructor(scope: GuStack, props: AppIdentity) { super(scope, "ParameterStoreRead", { - policyName: "parameter-store-read-policy", statements: [new ReadParametersByPath(scope, props), new ReadParametersByName(scope, props)], ...props, }); diff --git a/src/constructs/iam/roles/__snapshots__/instance-role.test.ts.snap b/src/constructs/iam/roles/__snapshots__/instance-role.test.ts.snap index 83748e5ed0..742c400429 100644 --- a/src/constructs/iam/roles/__snapshots__/instance-role.test.ts.snap +++ b/src/constructs/iam/roles/__snapshots__/instance-role.test.ts.snap @@ -192,7 +192,7 @@ exports[`The GuInstanceRole construct should allow additional policies to be spe ], "Version": "2012-10-17", }, - "PolicyName": "parameter-store-read-policy", + "PolicyName": "ParameterStoreReadTesting0F3B634A", "Roles": [ { "Ref": "InstanceRoleTestingCB7BD146", @@ -541,7 +541,7 @@ exports[`The GuInstanceRole construct should be possible to create multiple inst ], "Version": "2012-10-17", }, - "PolicyName": "parameter-store-read-policy", + "PolicyName": "ParameterStoreReadMyfirstappE5C5C329", "Roles": [ { "Ref": "InstanceRoleMyfirstapp5C11A22B", @@ -600,7 +600,7 @@ exports[`The GuInstanceRole construct should be possible to create multiple inst ], "Version": "2012-10-17", }, - "PolicyName": "parameter-store-read-policy", + "PolicyName": "ParameterStoreReadMysecondapp76C0E32C", "Roles": [ { "Ref": "InstanceRoleMysecondapp48DD15D7", @@ -871,7 +871,7 @@ exports[`The GuInstanceRole construct should create an additional logging policy ], "Version": "2012-10-17", }, - "PolicyName": "parameter-store-read-policy", + "PolicyName": "ParameterStoreReadTesting0F3B634A", "Roles": [ { "Ref": "InstanceRoleTestingCB7BD146", @@ -1090,7 +1090,7 @@ exports[`The GuInstanceRole construct should create the correct resources with m ], "Version": "2012-10-17", }, - "PolicyName": "parameter-store-read-policy", + "PolicyName": "ParameterStoreReadTesting0F3B634A", "Roles": [ { "Ref": "InstanceRoleTestingCB7BD146", diff --git a/src/experimental/patterns/__snapshots__/ec2-app.test.ts.snap b/src/experimental/patterns/__snapshots__/ec2-app.test.ts.snap index d5fb5bf916..a4be528b78 100644 --- a/src/experimental/patterns/__snapshots__/ec2-app.test.ts.snap +++ b/src/experimental/patterns/__snapshots__/ec2-app.test.ts.snap @@ -635,7 +635,7 @@ exports[`The GuEc2AppExperimental pattern matches the snapshot 1`] = ` ], "Version": "2012-10-17", }, - "PolicyName": "parameter-store-read-policy", + "PolicyName": "ParameterStoreReadTestguec2app072DCDE1", "Roles": [ { "Ref": "InstanceRoleTestguec2appC325BE42", diff --git a/src/experimental/patterns/__snapshots__/gu-load-balanced-app.test.ts.snap b/src/experimental/patterns/__snapshots__/gu-load-balanced-app.test.ts.snap index d5ac64b5c0..727da860ab 100644 --- a/src/experimental/patterns/__snapshots__/gu-load-balanced-app.test.ts.snap +++ b/src/experimental/patterns/__snapshots__/gu-load-balanced-app.test.ts.snap @@ -591,7 +591,7 @@ exports[`the GuLoadBalancedAppExperimental pattern should support all existing G ], "Version": "2012-10-17", }, - "PolicyName": "parameter-store-read-policy", + "PolicyName": "ParameterStoreReadTestguec2app072DCDE1", "Roles": [ { "Ref": "InstanceRoleTestguec2appC325BE42", @@ -1463,7 +1463,7 @@ exports[`the GuLoadBalancedAppExperimental pattern should support all existing G ], "Version": "2012-10-17", }, - "PolicyName": "parameter-store-read-policy", + "PolicyName": "ParameterStoreReadTestgu2D9B3F35", "Roles": [ { "Ref": "InstanceRoleTestguD5DB5D23", @@ -2337,7 +2337,7 @@ exports[`the GuLoadBalancedAppExperimental pattern should support experimental E ], "Version": "2012-10-17", }, - "PolicyName": "parameter-store-read-policy", + "PolicyName": "ParameterStoreReadTestgu2D9B3F35", "Roles": [ { "Ref": "InstanceRoleTestguD5DB5D23", @@ -3519,7 +3519,7 @@ exports[`the GuLoadBalancedAppExperimental pattern should support new ECS and hy ], "Version": "2012-10-17", }, - "PolicyName": "parameter-store-read-policy", + "PolicyName": "ParameterStoreReadTestgu2D9B3F35", "Roles": [ { "Ref": "EcsTaskDefinitionTaskRoleB7B6D8DD", diff --git a/src/patterns/ec2-app/__snapshots__/base.test.ts.snap b/src/patterns/ec2-app/__snapshots__/base.test.ts.snap index 8efbda9206..ec2ef9f8fd 100644 --- a/src/patterns/ec2-app/__snapshots__/base.test.ts.snap +++ b/src/patterns/ec2-app/__snapshots__/base.test.ts.snap @@ -591,7 +591,7 @@ exports[`the GuEC2App pattern can produce a restricted EC2 app locked to specifi ], "Version": "2012-10-17", }, - "PolicyName": "parameter-store-read-policy", + "PolicyName": "ParameterStoreReadTestguec2app072DCDE1", "Roles": [ { "Ref": "InstanceRoleTestguec2appC325BE42", @@ -1463,7 +1463,7 @@ exports[`the GuEC2App pattern should produce a functional EC2 app with minimal a ], "Version": "2012-10-17", }, - "PolicyName": "parameter-store-read-policy", + "PolicyName": "ParameterStoreReadTestguec2app072DCDE1", "Roles": [ { "Ref": "InstanceRoleTestguec2appC325BE42",